Expertise

IAM & Security

Identity & Access Management is the foundation of every modern, regulated IT landscape. Rising obligations from DORA, NIS 2, MaRisk, BAIT and ISO 27001:2022, hybrid cloud architectures and the zero-trust principle all demand an IAM that enforces least privilege consistently and stays audit-ready at all times. SempreAI supports you vendor-independently, from target architecture through tool selection to operations with reliable performance monitoring.

Consulting team discussing an identity and access management architecture in a control room — Securing digital access: with a role model that holds, zero-trust architecture and controls that survive any audit.

Overview

Why IAM & Security?

Entitlements grown over years, heterogeneous target systems and weak role governance reliably produce three outcomes: audit findings, excessive access risk, and recertification campaigns that create more effort than insight. Cloud migration and zero-trust models shift the underlying security logic fundamentally: from the network perimeter to identity as the control point.

At the same time regulatory pressure keeps rising. DORA and its regulatory technical standards require end-to-end ICT risk management including granular access logging and documented emergency procedures. NIS 2 widens the circle of obliged organisations considerably. ISO 27001:2022 sharpened the focus on access control, identity management, authentication information and the removal of rights through controls A.5.15 to A.5.18.

SempreAI translates these obligations into concrete, testable controls: recertification intervals by criticality, an SoD matrix with documented exceptions, break-glass accounts with complete session recording, access reviews with owner attestation, and automated reports for internal audit, external auditors and supervisory authorities.

What we deliver

Services in this area

IAM target architecture & strategy

From your business and IT strategy we develop a durable IAM target architecture including operating model, sourcing strategy and roadmap. Hybrid cloud landscapes, legacy core systems and third-party access all feed into one coherent identity fabric.

Maturity assessment
Target picture for IGA, PAM, authentication and federation
Zero-trust framework and segmentation
Business case and ROI modelling
Roadmap with delivery waves and KPI framework
Build-versus-buy assessment including total cost

Identity governance & administration

From first implementation to modernising an existing installation: configuration-led rather than code-heavy, performant and audit-ready. The work is tool-agnostic, drawing on experience with the established IGA platforms as well as directory and cloud identity services.

Data model, identity lifecycle and joiner-mover-leaver
Provisioning workflows and approval processes
Integration of target systems such as SAP, Active Directory, Entra ID, ServiceNow
Configurable recertification campaigns
Health checks, upgrade paths and performance tuning
Test concept, cutover and hypercare

Privileged access management

Privileged access belongs under control, conceptually as much as technically. That means vault and session concepts, just-in-time access with approval workflow, and clear thresholds above which elevated-risk activity escalates automatically.

PAM target architecture and operating model
Vault, session and rotation concepts
Just-in-time access and break-glass procedures
Four-eyes approval and delegation chains
Hardening of service and technical accounts
Integration with SIEM, monitoring and threat detection

RBAC & SoD modelling

Clear role models are the basis of efficient governance. Consolidation, clear-out and long-term modelling rest on data-driven role mining and an SoD matrix that maps regulatory conflict categories properly.

Role mining based on real assignment data
Separation of business and system roles
SoD matrix with conflict catalogue and exception procedure
Role ownership and maintenance process
Removal of accumulated entitlement debt
Metrics for role quality

Recertification & audit readiness

Recertification should reduce risk, not fill calendars. Campaigns are shaped around risk, managers are relieved through pre-filtering, and the evidence holds up in an audit conversation.

Risk-based campaign planning by criticality
Owner attestation with a traceable decision history
Automated removal of rights on rejection
Tamper-evident logging and retention
Audit reports for internal audit and regulators
KPI dashboards for coverage, cycle time and findings

Frequently asked questions

IAM & Security – Frequently asked questions

Which IAM tools do you work with?

SempreAI is deliberately tool-independent and follows your landscape. In projects we regularly encounter IGA platforms from the leading vendors, Microsoft Entra ID, classic directory services and specialised PAM and role-analytics solutions. The selection is driven by requirements, existing know-how and total cost across the lifecycle, not by vendor relationships.

How do you support DORA and MaRisk compliance?

The regulatory requirements are translated into concrete controls and evidence: compliant governance models, audit-ready recertification processes, SoD controls with documented exceptions, emergency access with a complete log chain, and KPI dashboards that stand up to external audit and supervisory review. The focus is on demonstrability, not paperwork.

Can you optimise an existing IAM system instead of rebuilding it?

In most cases that is the more economical route. It begins with a health check combining configuration analysis, performance measurement and process review. Typical levers are workflow refactoring, cleaning up custom code, optimising connectors to target systems, and modernising recertification campaigns. A platform change only becomes our recommendation once the existing estate demonstrably no longer carries.

How long does an IAM implementation take?

An assessment with target architecture and roadmap delivers reliable results within two to four weeks. Introducing an IGA platform with the first target systems realistically takes six to twelve months, depending on data quality, the number of systems and the speed of decision-making. Programmes are cut so that tangible value arrives after the first release rather than in a late big bang.

Let us talk about your initiative

Whether it is a target architecture, a recertification backlog, a legacy replacement or an operations handover: describe your starting position. We will come back within one working day with a concrete assessment.

Arrange a conversation